1.23.0-beta.0

Special Note: zod v4

This beta release adds support for zod v4, a highly requested addition.

Special thanks to @dclark27 @colinhacks for all the work on #1040 which adds this support while staying backwards compatible with zod v3!

NOTE: if you run into any issues with zod v4 in this SDK please raise an issue! We'll be monitoring actively for any issues while trying to use zod v4 as it's a highly anticipated update. In order to make this upgrade possible we needed to also require v3.25+ for zod v3. You may need to update your version of zod v3 if you've been using an older one. We're also making this a beta release while we get initial feedback on the update here.

What's Changed

• Migrate to vitest from jest by @mattzcarey in #1074
• ci: add workflow_dispatch trigger for manual CI runs by @felixweinberger in #1114
• Fix: @types/node incompatibility with vite warnings on npm install by @KKonstantinov in #1121
• Fix: clean up accidental spec.types.ts by @KKonstantinov in #1122
• fix: Pass RequestInit options to auth requests by @dsp-ant in #1066
• SEP-1036: URL Elicitation by @nbarbettini in #1105
• add none to test and the router. by @m-henderson in #1116
• [auth] Adjust scope management to line up with SEP-835 by @pcarleton in #1133
• chore: add .idea/ to .gitignore by @maxisbey in #1134
• chore: remove unused @types/eslint__js dependency by @mattzcarey in #1128
• feat: url based client metadata registration (SEP 991) by @mattzcarey in #1127
• feat: zod v4 with backwards compatibility for v3.25+ by @dclark27 in #1040
• fix: remove pnpm lock and regenerate package-lock by @mattzcarey in #1138
• docs: update installation instructions for zod peer dependency by @mattzcarey in #1139
• Implement SEP-1577 - Sampling With Tools by @ochafik in #1101
• Follow up: unify v3 and v4 zod types via describe matrix and a test helper by @KKonstantinov in #1141
• chore: Add deprecated marker to old elicitInput overload by @nbarbettini in #1142
• fix: Connect error in URL elicitation example by @nbarbettini in #1136
• Support upscoping on insufficient_scope 403 by @Nayana-Parameswarappa in #1115
• Support beta releases by publishing with --tag beta by @felixweinberger in #1146
• Bump version to 1.23.0-beta.0 by @felixweinberger in #1147

New Contributors

• @nbarbettini made their first contribution in #1105
• @m-henderson made their first contribution in #1116
• @maxisbey made their first contribution in #1134
• @dclark27 made their first contribution in #1040
• @Nayana-Parameswarappa made their first contribution in #1115

Full Changelog: 1.22.0...1.23.0-beta.0

1.22.0

What's Changed

• registerTool: accept ZodType for input and output schema by @ksinder in #816
• SEP-1319: Decouple Request Payloads, Remove passthrough iteration, Typecheck fixes by @KKonstantinov in #1086
• add pkg-pr-new bot by @pcarleton in #1088
• Upgrade to Node LTS by @mattzcarey in #1072
• change step name by @pcarleton in #1089
• SEP-1034: Default values for Elicitation Schemas by @KKonstantinov in #1096
• SEP-1330: Compatibility with SEP-1034 by @KKonstantinov in #1100
• Implementation of SEP-986: Specify Format for Tool Names by @kentcdodds in #900
• [auth] Fix march spec fallback for metadata discovery by @pcarleton in #1108
• chore: bump version for release by @felixweinberger in #1110

New Contributors

• @ksinder made their first contribution in #816

Full Changelog: 1.21.1...1.22.0

1.21.2

What's changed

This is a patch release for a regression highlighted by #1103

This patch contains only the cherry picked fix in #1108

Full Changelog: 1.21.1...1.21.2

1.21.1

What's Changed

• Only use path-based discovery URLs from the authorization server to discover metadata by @roadmapper in #1070
• Add @deprecated annotations to legacy APIs by @domdomegg in #1018
• fix: Support WWW-Authenticate scope param for SEP-835 by @chipgpt in #983
• move CLI script to dedicated scripts directory by @mattzcarey in #1073
• Check script which typechecks using Typescripts new Go port by @mattzcarey in #1075
• FIX: use a nightly spec.types.ts by @mattzcarey in #1087
• chore: bump version for release by @felixweinberger in #1085

New Contributors

• @roadmapper made their first contribution in #1070

Full Changelog: 1.21.0...1.21.1

1.21.0

What's Changed

• feat: pluggable JSON schema validator providers by @mattzcarey in #1012
• Update metadata.ts by @pcarleton in #1010
• fix: Prefer the token_endpoint_auth_method response from DCR registration by @chipgpt in #1022
• Fix: Non-existent tool, disabled tool and inputSchema validation return MCP protocol level instead of CallToolResult with isError: true by @KKonstantinov in #1044
• chore: bump version to 1.21.0 for release by @felixweinberger in #1062

New Contributors

• @chipgpt made their first contribution in #1022

Full Changelog: 1.20.2...1.21.0

1.20.2

What's Changed

• fix: Zod to JSONSchema pipe strategies by @pierreliefauche in #962
• chore: bump version for weekly release by @felixweinberger in #1042

New Contributors

• @pierreliefauche made their first contribution in #962

Full Changelog: 1.20.1...1.20.2

1.20.1

What's Changed

• fix: Add Accept header to auth metadata request by @SVLaursen in #901
• Allow empty string as valid URL in DCR workflow by @fredericbarthelet in #987
• docs: fix summary contents at readme by @starfish719 in #1025
• chore: bump version to 1.20.1 for release by @felixweinberger in #1032

New Contributors

• @SVLaursen made their first contribution in #901
• @starfish719 made their first contribution in #1025

Full Changelog: 1.20.0...1.20.1

1.20.0

What's Changed

• docs: improve main README with better quick start, include examples of stateless HTTP, explain tools v resources v prompts by @domdomegg in #980
• chore: add lint:fix script by @mattzcarey in #1013
• Default to S256 code challenge if not specified in authorization server metadata by @LucaButBoring in #992

New Contributors 🙏

• @mattzcarey made their first contribution in #1013

Full Changelog: 1.19.0...1.20.0